CISA Adds One Known Exploited Vulnerability to Catalog
2026-10-15T21:24:03Z•e67ab379bc8a60ebfac04484815622682faae268440aeca86d71584888720eeb
CVE-2026-0322CVE-2026-102489CVE-2026-102490CVE-2026-104286CVE-2026-104935CVE-2026-105133CVE-2026-105134CVE-2026-21589CVE-2026-76519CVE-2026-88779CVE-2026-96951AhsayCBSAtlassianCISACisco Secure Email GatewayCitrix NetScalerFortinet FortiMailIvanti Connect SecureKEVKnown Exploited VulnerabilitiesMicrosoft WindowsPAN-OSZammadactive exploitationauthentication bypasscommand injectionpath traversalprivilege escalationremote code executionvulnerability managementzero-day
What happened
CISA reports multiple vulnerabilities added to its Known Exploited Vulnerabilities (KEV) Catalog during October 2026, confirming active exploitation. Affected products include Atlassian, Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, AhsayCBS, Ivanti Connect Secure, Microsoft Windows, Citrix NetScaler, Zammad, and Fortinet FortiMail. The Ivanti Connect Secure zero-day (CVE-2026-104935) enables remote unauthenticated arbitrary command execution for credential theft and data exfiltration; CISA urges immediate patching and network and memory forensics because conventional integrity checks
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- e67ab379bc8a60ebfac04484815622682faae268440aeca86d71584888720eeb
- Enrichment time
- 2026-10-15T21:24:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.